#!/bin/bash

# export KUBECONFIG=~/admin.kubeconfig
LOCAL_IP=192.168.56.13
POD_CIDR=172.16.0.0/16
SERVICE_CIDR=10.96.0.0/16

MASTER01=192.168.56.11
MASTER02=192.168.56.12
MASTER03=192.168.56.13

# read -p "type master node name; (like: 1) " LOCAL_IP

# if [ $LOCAL_IP -eq 1 ]; then
# LOCAL_IP=$MASTER01
# elif [ $LOCAL_IP -eq 2 ]; then
# LOCAL_IP=$MASTER02
# elif [ $LOCAL_IP -eq 3 ]; then
# LOCAL_IP=$MASTER03
# else
# LOCAL_IP=$MASTER01
# fi

# 证书相关
PKI_PATH=/etc/kubernetes/pki
CA_CERT=$PKI_PATH/ca.crt
CA_KEY=$PKI_PATH/ca.key
KUBE_APISERVER_CERT=$PKI_PATH/kube-apiserver.crt
KUBE_APISERVER_KEY=$PKI_PATH/kube-apiserver.key
KUBE_PROXY_CERT=$PKI_PATH/kube-proxy.crt
KUBE_PROXY_KEY=$PKI_PATH/kube-proxy.key
KUBE_CONTROLLER_MANAGER_CERT=$PKI_PATH/kube-controller-manager.crt
KUBE_CONTROLLER_MANAGER_KEY=$PKI_PATH/kube-controller-manager.key
KUBE_SCHEDULER_CERT=$PKI_PATH/kube-scheduler.crt
KUBE_SCHEDULER_KEY=$PKI_PATH/kube-scheduler.key
KUBE_ADMIN_CERT=$PKI_PATH/admin.crt
KUBE_ADMIN_KEY=$PKI_PATH/admin.key

FRON_PROXY_CA_CERT=$PKI_PATH/ca.crt
FRON_PROXY_CERT=$PKI_PATH/front-proxy-client.crt
FRON_PROXY_KEY=$PKI_PATH/front-proxy-client.key

ETCD_CA_CERT=$PKI_PATH/ca.crt
ETCD_CERT=$PKI_PATH/etcd.crt
ETCD_KEY=$PKI_PATH/etcd.key
SA_PUB=$PKI_PATH/sa.pub
SA_KEY=$PKI_PATH/sa.key

KUBECONFIG_PATH=/etc/kubernetes/kubeconfig
# kubeconfig
KUBE_CONTROLLER_MANAGER_CFG=$KUBECONFIG_PATH/kube-controller-manager.kubeconfig
KUBE_SCHEDULER_CFG=$KUBECONFIG_PATH/kube-scheduler.kubeconfig
KUBE_PROXY_CFG=$KUBECONFIG_PATH/kube-proxy.kubeconfig
KUBE_ADMIN_CFG=$KUBECONFIG_PATH/admin.kubeconfig

KUBE_CONTROLLER_MANAGER_CONFIG=--kubeconfig=$TMP_KUBECONFIG_PATH/kube-controller-manager.kubeconfig
KUBE_PROXY_CONFIG=--kubeconfig=$TMP_KUBECONFIG_PATH/kube-proxy.kubeconfig
KUBE_SCHEDULER_CONFIG=--kubeconfig=$TMP_KUBECONFIG_PATH/kube-scheduler.kubeconfig
KUBE_ADMIN_CONFIG=--kubeconfig=$TMP_KUBECONFIG_PATH/admin.kubeconfig

cat <<EOF | sudo tee /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes
After=network.target

[Service]
ExecStart=/usr/local/bin/kube-apiserver \\
      --v=2  \\
      --allow-privileged=true  \\
      --bind-address=0.0.0.0  \\
      --secure-port=6443  \\
      --advertise-address=$LOCAL_IP \\
      --service-cluster-ip-range=$SERVICE_CIDR  \\
      --service-node-port-range=30000-32767  \\
      --etcd-servers=https://$MASTER01:2379,https://$MASTER02:2379,https://$MASTER03:2379 \\
      --etcd-cafile=$ETCD_CA_CERT  \\
      --etcd-certfile=$ETCD_CERT  \\
      --etcd-keyfile=$ETCD_KEY  \\
      --client-ca-file=$CA_CERT  \\
      --tls-cert-file=$KUBE_APISERVER_CERT  \\
      --tls-private-key-file=$KUBE_APISERVER_KEY  \\
      --kubelet-client-certificate=$KUBE_APISERVER_CERT  \\
      --kubelet-client-key=$KUBE_APISERVER_KEY  \\
      --service-account-key-file=$SA_PUB  \\
      --service-account-signing-key-file=$SA_KEY  \\
      --service-account-issuer=https://kubernetes.default.svc.cluster.local \\
      --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname  \\
      --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota  \\
      --authorization-mode=Node,RBAC  \\
      --enable-bootstrap-token-auth=true  \\
      --requestheader-client-ca-file=$FRON_PROXY_CA_CERT  \\
      --proxy-client-cert-file=$FRON_PROXY_CERT  \\
      --proxy-client-key-file=$FRON_PROXY_KEY  \\
      --requestheader-allowed-names=aggregator  \\
      --requestheader-group-headers=X-Remote-Group  \\
      --requestheader-extra-headers-prefix=X-Remote-Extra-  \\
      --requestheader-username-headers=X-Remote-User

Restart=on-failure
RestartSec=10s
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target
EOF

# ==================================================kubernetes-controler-manager=================================================================
# ==================================================kubernetes-controler-manager=================================================================
# Controller Manager负责维护集群中的证书和私钥,所以需要配置ca.crt 和 ca.key
cat <<EOF | sudo tee /usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/kubernetes/kubernetes
After=network.target

[Service]   
ExecStart=/usr/local/bin/kube-controller-manager \\
      --v=2 \\
      --root-ca-file=$CA_CERT \\
      --cluster-signing-cert-file=$CA_CERT \\
      --cluster-signing-key-file=$CA_KEY \\
      --service-account-private-key-file=$SA_KEY \\
      --kubeconfig=$KUBE_CONTROLLER_MANAGER_CFG \\
      --authentication-kubeconfig=$KUBE_CONTROLLER_MANAGER_CFG \\
      --authorization-kubeconfig=$KUBE_CONTROLLER_MANAGER_CFG \\
      --leader-elect=true \\
      --use-service-account-credentials=true \\
      --node-monitor-grace-period=40s \\
      --node-monitor-period=5s \\
      --controllers=*,bootstrapsigner,tokencleaner \\
      --allocate-node-cidrs=true \\
      --service-cluster-ip-range=$SERVICE_CIDR \\
      --cluster-cidr=$POD_CIDR \\
      --requestheader-client-ca-file=$FRON_PROXY_CA_CERT \\
      --node-cidr-mask-size=24
      
Restart=always
RestartSec=10s

[Install]
WantedBy=multi-user.target
EOF

# ==================================================kubernetes-scheduler=================================================================
# ==================================================kubernetes-scheduler=================================================================
cat <<EOF | sudo tee /usr/lib/systemd/system/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/kubernetes/kubernetes
After=network.target

[Service]
ExecStart=/usr/local/bin/kube-scheduler \\
      --v=2 \\
      --leader-elect=true \\
      --authentication-kubeconfig=$KUBE_SCHEDULER_CFG \\
      --authorization-kubeconfig=$KUBE_SCHEDULER_CFG \\
      --kubeconfig=$KUBE_SCHEDULER_CFG

Restart=always
RestartSec=10s

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload 
sudo systemctl enable --now kube-apiserver kube-controller-manager kube-scheduler

# sudo tail -f /var/log/messages
# sudo systemctl stop kube-apiserver kube-controller-manager kube-scheduler kubelet
# sudo journalctl -x kube-apiserver.service
# sudo systemctl restart kube-apiserver kube-controller-manager kube-scheduler
# sudo /usr/local/bin/kubectl get cs --kubeconfig /etc/kubernetes/kubeconfig/admin.kubeconfig
